Interview Q19: How defend prompt injection?
Treat retrieved content as untrusted, restrict tools, enforce authorization, minimize secrets, and test hostile sources.
Interview tip: define the concept, explain a trade-off, and name a production control or metric.
Implementation example
function validateCitation(id, allowedIds) {
if (!allowedIds.has(id)) throw new Error("Invalid citation");
return id;
}💡 This small example demonstrates a general boundary check; adapt it to the actual retrieval result and authorization model.
Key Takeaways
- Inspect the relevant pipeline stage instead of guessing.
- Preserve source provenance, versions, and access scope.
- Measure quality on representative queries.
Knowledge Check
Strong control?